CVE-2026-26445
Description
A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP (Streaming Text Oriented Messaging Protocol) frames. This action can cause the broker's sockets to enter a permanent half-read state. Consequently, the broker stops processing new messages, leading to a Denial of Service (DoS) for legitimate users.
Statement
A flaw was found in stomper. A remote unauthenticated attacker can cause a Denial of Service by sending partial STOMP frames over open TCP connections. When combined with the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), sockets enter a permanent half-read state. Once enough connections accumulate, the broker stops receiving epoll events for these sockets and hangs in epoll_wait, refusing new messages. Red Hat default security controls (e.g., non-root execution, process isolation) do not prevent this service-level socket starvation, though network boundaries can limit exposure.
Mitigation
Limit exposure by configuring network firewalls or security groups to restrict access to the STOMP broker port only to trusted clients. Alternatively, reduce the connection timeout and limit the maximum allowed unauthenticated TCP connections per host at the infrastructure or ingress layer.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
